SYSTEM AND METHOD TO AUTHORIZE RESTRICTED FUNCTIONALITY

Abstract

Embodiments of the invention are related to medical systems and methods for controlling authorization of restricted functionality, amongst other things. In an embodiment, the invention includes a medical system including an external medical device programmer comprising control circuitry and a wireless communications module for sending instructions selected from a set of instructions wirelessly to a specific implanted medical device. In an embodiment, the external medical device programmer can be configured to initiate a transfer of verifying data to a remote key authority requesting permission if the user input directs delivery of restricted instructions to the specific implanted medical device, the verifying data including information regarding the specific implanted medical device. Other embodiments are also included herein.

Description

This application claims the benefit of U.S. Provisional Application No. 61/287,012, filed Dec. 16, 2009, the contents of which are herein incorporated by reference.

TECHNICAL FIELD

This disclosure relates generally to medical devices and, more particularly, to medical systems and methods for controlling authorization of restricted functionality, amongst other things.

BACKGROUND OF THE INVENTION

Implantable medical devices are commonly used to treat patients with various conditions. By way of example, conditions of the heart such as tachycardia, bradycardia, and heart failure, amongst others, are now routinely treated using implantable cardiac rhythm management (CRM) devices. In addition, various conditions such as epilepsy, chronic pain, Parkinson's disease, and depression can now be treated using implantable neurostimulation devices.

Patients with such implantable devices may periodically visit clinicians for follow-up appointments. During these follow-up appointments, clinicians may perform programming tasks such as adjusting the therapy settings of the implanted device in addition to accessing and reviewing data gathered by the device. In order to perform these tasks, the clinician will typically use an external device, such as a programmer or programmer-recorder-monitor (PRM) device in order to interrogate the implanted medical device and reprogram it if necessary.

SUMMARY OF THE INVENTION

Embodiments of the invention are related to medical systems and methods for controlling authorization of restricted functionality, amongst other things. In an embodiment, the invention includes a medical system including an external medical device programmer comprising control circuitry and a wireless communications module for sending instructions selected from a set of instructions wirelessly to a specific implanted medical device, the set of instructions comprising restricted and non-restricted instructions. The external medical device programmer can be configured to receive input from a system user regarding which instructions from the set of instructions are to be delivered to the specific implanted medical device. The external medical device programmer can be configured to initiate a transfer of verifying data to a remote key authority requesting permission if the user input directs delivery of restricted instructions to the specific implanted medical device, the verifying data including information regarding the specific implanted medical device. Also, the external medical device programmer can be configured to receive a digital key from the remote key authority if permission is granted, the digital key effective to allow the external programmer to implement restricted instructions on the specific implanted device, wherein the digital key is effective for a defined time period.

In an embodiment, the invention includes a medical system including an implantable medical device, an external medical device programmer comprising control circuitry and a wireless communications module, and a remote key authority comprising a processor. The external medical device programmer can be configured to send instructions selected from a set of instructions wirelessly to the implanted medical device, the set of instructions comprising restricted and non-restricted instructions. The external medical device programmer can also be configured to receive input from a system user regarding instructions to be delivered to the implantable medical device. The external medical device programmer can also be configured to initiate a transfer of data to the remote key authority requesting permission if the user input directs delivery of restricted instructions to the implantable medical device, the data including information regarding the implantable medical device, The external medical device programmer can also be configured to receive a digital key from the remote key authority if permission is granted that enables the external medical device programmer to implement restricted instructions on the implantable medical device.

In an embodiment, the invention includes a method for restricting programming instructions delivered to an implanted medical device. The method can include receiving with an external medical device programmer instructions from a system user for a specific implanted medical device. The method can further include sending information from the external medical device programmer regarding the specific implanted medical device to a remote key authority if the instructions are restricted instructions. The method can also include receiving a digital key from the remote key authority, the digital key configured to enable the external medical device programmer to implement the restricted instructions.

This summary is an overview of some of the teachings of the present application and is not intended to be an exclusive or exhaustive treatment of the present subject matter. Further details are found in the detailed description and appended claims. Other aspects will be apparent to persons skilled in the art upon reading and understanding the following detailed description and viewing the drawings that form a part thereof, each of which is not to be taken in a limiting sense. The scope of the present invention is defined by the appended claims and their legal equivalents.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention may be more completely understood in connection with the following drawings, in which:

FIG. 1 is a schematic diagram of a system, consistent with at least one embodiment of the technology disclosed herein.

FIG. 2 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein.

FIG. 3 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein.

FIG. 4 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein.

FIG. 5 is a schematic diagram of various programmer device components shown in accordance with at least one embodiment of the technology disclosed herein.

FIG. 6 is a schematic diagram of various implantable medical device components shown in accordance with at least one embodiment of the technology disclosed herein.

While the invention is susceptible to various modifications and alternative forms, specifics thereof have been shown by way of example and drawings, and will be described in detail. It should be understood, however, that the invention is not limited to the particular embodiments described. On the contrary, the intention is to cover modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION

Patients with implantable devices that deliver therapy may periodically visit clinicians for follow-up appointments. During these follow-up appointments, clinicians commonly perform tasks such as adjusting the therapy settings of the implanted device in addition to accessing and reviewing data gathered by the device. In order to perform these tasks, the clinician will typically use an external device, such as a programmer or a programmer-recorder-monitor (PRM) device in order to interrogate the implanted medical device and send instructions to it for reprogramming if necessary.

However, it may occasionally become necessary to take steps that are not routine. For example, it may become necessary to update the firmware of a device or to trigger a system reset. While it is important to provide a mechanism through which these steps can take place, it is also important to maintain control over how and when these types of extraordinary steps are taken and to prevent system users from undertaking such steps accidentally.

Embodiments of the invention can help avoid possible issues by controlling how restricted system functionality can be engaged and/or implemented. As such, embodiments of the invention can enable certain non-typical steps to be taken when necessary, while maintaining control over the same, thereby ensuring patient safety.

FIG. 1 is a schematic diagram of an example implementation, consistent with at least one embodiment of the invention. An implantable medical device 114 is disposed within a patient 112. The implantable medical device 114 can include one or more stimulation leads 122 that are positioned within proximity of the patient's heart 126.

The implantable medical device 114 can be in communication with an external medical device programmer 116. In some embodiments, the implantable medical device 114 can be in wireless communication with the external medical device programmer 116. Various types of wireless technologies can be used in order to facilitate communication between the external medical device programmer 116 and the implantable medical device 114. By way of example, communication can be carried out through induction, radiofrequency (RF) transmission, acoustically, or the like.

The implantable medical device 114 can be configured to gather data and transmit data to the external medical device programmer 116. For example, the implantable medical device 114 can include sensors and gather data such as heart rate data, electrogram data, pressure data, volume data, flow rate data, temperature data, chemical analyte data, activity data, and/or accelerometer data. The implantable medical device 114 can transmit real-time data to the external medical device programmer 116. In some embodiments, the external medical device programmer 116 can display the real-time data through a video output 118.

The external medical device programmer 116 can also send instructions to the implantable medical device 114 in order to control its functioning. The instructions can be selected from a set of possible instructions. The set of instructions can include restricted and non-restricted instructions. Restricted instructions can include those for which authorization is required before implementation on the implantable medical device 114. Non-restricted instructions can include those for which authorization is not required before implementation on the implantable medical device 114. Examples of restricted and non-restricted instructions are provided in greater detail below. Further, the external medical device programmer 116 can receive input from a system user regarding which instructions from the set of instructions are to be delivered to the specific implanted medical device.

The external medical device programmer 116 can be any type of device or combination of devices capable of sending instructions to the implantable medical device 114. In many embodiments, the external medical device programmer 116 is a programmer/recorder/monitor device. Exemplary programmer/recorder/monitor devices include the Model 3120 Programmer available from Boston Scientific Corporation, Natick, Mass. However, it will be appreciated that the external medical device programmer 116 can also take on other forms such as an in-home monitoring system or advanced patient management system. An exemplary in-home monitoring system is the LATITUDE® advanced patient management system, available from Boston Scientific Corporation, Natick, Mass. Aspects of exemplary in-home monitoring systems are described in U.S. Pat. No. 6,978,182, the content of which is herein incorporated by reference in its entirety.

The external medical device programmer 116 can be in communication with a communication network 130. The communication network 130 can be of various types such as a LAN, WAN, a telephonic network, the Internet, or the like. Through the communication network 130, the external medical device programmer 116 can be in communication with a remote key authority 132 either directly or indirectly. In some embodiments, communication through the communication network 130 involves the intervention of a human. In other embodiments, communication through the communication network 130 is completely automated.

The external medical device programmer 116 can be configured to request permission from the remote key authority 132 if the user input directs delivery of restricted instructions to the implanted medical device 114. In some embodiments, the external medical device programmer 116 can also be configured to initiate a transfer of verifying data to the remote key authority 132 in the context of requesting permission if the user input directs delivery of restricted instructions to the implanted medical device 114. The verifying data can include information specific to the particular implanted medical device 114 in question and/or specific to the patient into which the medical device is implanted. For example, the verifying data could include a patient name, a patient identifying number, a device serial number, or the like.

The remote key authority 132 can include various components. By way of example, the remote key authority 132 can include a server 134. The server 134 can include components such as a processor 136, a memory 138, input/output interfaces 140, and the like. The memory can have instructions stored thereon causing the remote key authority to execute various steps and methods described herein. By way of example, the memory can have instructions stored thereon causing the remote key authority to execute steps as shown in FIG. 3.

The remote key authority 132 can be configured to evaluate the request for permission received from and/or initiated by the external medical device programmer 116. In some embodiments, the remote key authority 132 can be configured to select between automatically responding and requesting human input from an authoritative system expert 152. For example, some restricted instructions may be “system determinable” in that the system can either authorize or deny permission to implement them based on the specific nature of the restricted instruction and facts about the patient and/or specific implanted device in question. Other restricted instructions may be “system non-determinable” in that the system must resort to seeking human input from an authoritative system expert 152 before being able to grant or deny permission for the restricted instructions.

If the remote key authority 132 grants permission to the external medical device programmer to implemented the restricted instruction, then the remote key authority 132 can effectuate this by generating a digital key, such as a cryptographic digital key, and sending the digital key to the external medical device programmer 116. The digital key can enable the external medical device programmer 116 to implement the restricted instructions on the implantable medical device. In some embodiments, the digital key can include a series of integers.

It will be appreciated that there are many ways in which to generate a digital key. For example, aspects of digital key generation can be found in U.S. Pat. No. 4,218,582. In some embodiments, the cryptographic digital key can include information derived from the verifying data originally passed from the external medical device programmer 116 to the remote key authority 132. For example, data from the verifying data can be used as a pass phrase and a key generation algorithm utilizing a cryptographic hash function such as SHA-1 or SHA-2 can be used to generate the key. In some embodiments, the key can be generated with algorithm that uses, as input, data about the specific patient, information regarding the specific restricted instruction, and/or the current time of day.

In some embodiments, the cryptographic digital key can be effective to allow the external medical device programmer 116 to implement the restricted instructions on the implantable medical device only for a limited period of time, such as only for the current programming session or only for a predefined limited period of time. For example, in some embodiments, the cryptographic digital key can be effective to allow the external medical device programmer 116 to implement the restricted instructions on the implantable medical device only for as long as the current programming session between the external medical device programmer 116 and the implanted medical device 114. In some embodiments, the cryptographic digital key can be effective to allow the external medical device programmer 116 to implement the restricted instructions on the implantable medical device only for a predefined limited period of time. By way of example, in some embodiments the cryptographic digital key can be effective for a period of time less than or equal to 48 hours. In some embodiments the cryptographic digital key can be effective for a period of time less than or equal to 24 hours. In some embodiments the cryptographic digital key can be effective for a period of time less than or equal to 12 hours. In some embodiments the cryptographic digital key can be effective for a period of time less than or equal to 2 hours.

As described above, the set of all possible instructions that can be sent from an external medical device programmer to a specific implanted medical device can include both non-restricted and restricted instructions. Non-restricted instructions can include those instructions for which authorization is not required before implementation on the implantable medical device. Non-restricted instructions can include common instructions such as those relating to therapy (e.g., pacing mode, stimulation amplitude, pulse width, stimulation rate, and the like).

Restricted instructions can include those instructions for which authorization is required before implementation on the implantable medical device. Examples of restricted instructions can include, but are not limited to, system reset, firmware updates, reloading of software onto the implantable medical device, enabling or disabling certain features or functions of the implantable medical device, and the like. Restricted instructions can further include regulatory restricted and non-regulatory restricted instructions. Regulatory restricted instructions are those that may require action relating to a regulatory body either prior to or after implementation of the instructions. For example, the implementation of some instructions may require the implantable device manufacturer to notify a regulatory body after implementation. As another example, the implementation of some instructions may require prior regulatory body approval before implementation.

FIG. 2 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein. In operation 202 an external medical device programmer can interrogate an implanted medical device. Interrogation can include establishing communication with the implanted medical device and querying and receiving information about the specific implanted medical device and/or the patient in which the implanted medical device lies. In another operation 204, the external medical device programmer can receive programming instructions from a system user. The programming instructions can be selected from a set of instructions including restricted and non-restricted instructions.

In another operation 206, the external medical device programmer can determine whether or not the instructions include restricted instructions. Though various techniques could be used, in at least one embodiment the external medical device programmer can determine whether or not the instructions include restricted instructions by querying each instruction against a database that indicates whether or not the particular instruction is restricted.

If the instructions do not include restricted instructions, then the system can proceed to another operation 216 wherein the instructions are implemented on an implanted medical device. Implementing the instructions on an implanted medical device can include physically sending the instructions to the implanted medical device or otherwise causing the instructions to take effect on the implanted medical device.

However, if the instructions do include restricted instructions, then in operation 208 the external medical device programmer can request permission from a remote key authority. After requesting permission, the external medical device programmer can determine whether or not permission has been granted in operation 210. If permission has not been granted, then the external medical device programmer can notify a system user that permission is denied in operation 212, ending the process. Notification can take place through a variety of ways such as a message on screen (e.g., a pop-up box, or the like), an audio cue, or the like. However, if permission has been granted, then in operation 214 the external medical device programmer can receive a digital key from a remote key authority. After receiving the digital key, the system can implement instructions on an implanted medical device in another operation 216. Finally, the external medical device programmer can create a log entry regarding the transaction in operation 218. The log entry can be stored locally on the external medical device programmer, on a computer that the external medical device programmer can communicate with, or pushed onto the implanted medical device itself.

FIG. 3 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein. In operation 302 a remote key authority can receive a permission request regarding restricted instructions along with identifying information regarding the particular external medical device programmer sending or initiating the request, the particular implanted medical device, or the particular patient into which the medical device is implanted.

In operation 304 the remote key authority can determine whether or not the request is for system determinable instructions. Though various techniques could be used, in at least one embodiment the remote key authority can determine whether or not the request is for system determinable instructions by querying a database that indicates whether or not the restricted instructions are determinable based on the identity or type of the restricted instructions.

If the request is not for system determinable instructions, then the remote key authority can query an authoritative system expert in operation 306, before assessing whether permission should be granted in operation 308. However, if the request is for system determinable instructions, then the remote key authority can move onto assessing whether permission should be granted in operation 308 without querying an authoritative system expert.

If it is determined in operation 308 that permission should not be granted, then in operation 310 the remote key authority can send a notice to the external medical device programmer that permission is denied. However, if it is determined in operation 308 that permission should be granted, then in operation 312, the remote key authority can send a digital key to the external medical device programmer. In operation 314, the remote key authority can create a log entry regarding the transaction (e.g. the request and the response provided). The log entry can be stored locally on the remote key authority, on a computer that the remote key authority can communicate with, on the external medical device programmer, or on the implanted medical device itself.

In some embodiments, the implanted medical device itself can initiate a request for permission from a remote key authority for a restricted instruction. For example, rather than the external medical device programmer serving as a gatekeeper and sending or initiating a request for permission based upon user input directing delivery of restricted instructions to the specific implanted medical device, the implanted medical device itself can initiate a request for permission from a remote key authority in some embodiments. FIG. 4 is a flow diagram in accordance with at least one embodiment of the technology disclosed herein. The implanted medical device can receive programming instructions from a programmer device in a first operation 402. The implanted medical device can then determine whether or not the instructions include restricted instructions in operation 404. If the instructions do not include restricted instructions then the implanted medical device can move on to implementing the instructions in operation 412.

However, if the instructions do include restricted instructions then the implanted medical device can initiate a request for permission from the remote key authority in operation 406. For example, initiating a request for permission from the remote key authority can include sending a notification back to the external medical device programmer that permission must be granted by a remote key authority before a specific instruction can be implemented. In some embodiments, initiating a request for permission from the remote key authority can include causing a request to be send directly to the remote key authority.

The implanted medical device can determine in operation 408 whether or not permission has been received from the remote key authority in the form of a digital key. If a digital key has not been received, then in operation 410 the implanted medical device can notify the external medical device programmer that permission has been denied regarding the restricted instruction. However, if a digital key has been received, then in operation 412 the implanted medical device can move on to implement the instructions. After implementing instructions, the implanted medical device can move on to create a log entry regarding the transaction in operation 414.

It will be appreciated that external medical device programmers of various embodiments can include a variety of specific components in order to carry out specific functions and methods as described herein. Referring now to FIG. 5, a diagram of various components that can be included in an external medical device programmer is shown in accordance with an embodiment of the invention. The system can include control circuitry including, for example, a central processing unit (CPU) 505 or processor, which may include a conventional microprocessor, random access memory (RAM) 510 for temporary storage of information, and read only memory (ROM) 515 for permanent storage of information. The memory (RAM and/or ROM) can have instructions stored thereon causing the external medical device programmer to execute various steps and methods described herein. By way of example, the memory can have instructions stored thereon causing the external medical device programmer to implement the steps according to FIG. 2. A memory controller 520 is provided for controlling system RAM 510. A bus controller 525 is provided for controlling data bus 530, and an interrupt controller 535 is used for receiving and processing various interrupt signals from the other system components.

Mass storage may be provided by diskette drive 541, which is connected to bus 530 by controller 540, CD-ROM drive 546, which is connected to bus 530 by controller 545, and/or a hard disk drive 551, which is connected to bus 530 by controller 550. User input to the system may be provided by a number of devices. For example, a keyboard and mouse can connected to bus 530 by keyboard and mouse controller 555. DMA controller 560 is provided for performing direct memory access to system RAM 510. A visual display is generated by a video controller 565, which controls video display 570. The system can also include a telemetry interface circuit 590 or wireless communications module that allows the system to interface and exchange data with an implantable medical device. It will be appreciated that in various embodiments not all of the components depicted in FIG. 5 may be present.

Referring now to FIG. 6, some components of an exemplary implantable system 600 are schematically illustrated. However, it will be appreciated that in some embodiments some of the elements of the controller module 672 shown in FIG. 6 may be omitted. Further, in some embodiments, additional elements may be included. The implantable medical system 600 can include a controller module 672 coupled to one or more stimulation leads 630 and 628. The controller module 672 can include a microprocessor 648 (or processor) that communicates with a memory 646. The memory 646 typically includes ROM or RAM for program storage and RAM for data storage. The controller module 672 can be configured to execute various operations such as execution of methods as described herein. A telemetry interface 664 is also provided for communicating with an external unit, such as a programmer device or a patient management system.

In some embodiments, the controller module 672 can include ventricular sensing and pacing channels including sensing amplifier 652, output circuit 654, and a ventricular channel interface 650 which communicates bidirectionally with a port of microprocessor 648. The ventricular sensing and pacing channel can be in communication with stimulation lead 630 and electrode 634.

In some embodiments, the controller module 672 can include atrial sensing and pacing channels including sensing amplifier 658, output circuit 660, and an atrial channel interface 656 which communicates bidirectionally with a port of microprocessor 648. The atrial sensing and pacing channel can be in communication with stimulation lead 628 and electrode 632. For each channel, the same lead and electrode can be used for both sensing and pacing.

The channel interfaces 650 and 656 can include analog-to-digital converters for digitizing sensing signal inputs from the sensing amplifiers and registers which can be written to by the microprocessor in order to output pulses, change the pacing pulse amplitude, and adjust the gain and threshold values for the sensing amplifiers. In some embodiments, a shock pulse generator 674 can also be interfaced to the microprocessor for delivering defibrillation shocks to the heart via a separate pair of electrodes 676, 678. In some embodiments, electrodes 676 and 678 can be disposed along stimulation lead 630 and stimulation lead 628 respectively.

It should be noted that, as used in this specification and the appended claims, the singular forms “a,” “an,” and “the” include plural referents unless the content clearly dictates otherwise. It should also be noted that the term “or” is generally employed in its sense including “and/or” unless the content clearly dictates otherwise.

It should also be noted that, as used in this specification and the appended claims, the phrase “configured” describes a system, apparatus, or other structure that is constructed or configured to perform a particular task or adopt a particular configuration. The phrase “configured” can be used interchangeably with other similar phrases such as “arranged”, “arranged and configured”, “constructed and arranged”, “constructed”, “manufactured and arranged”, and the like.

One of ordinary skill in the art will understand that the modules, circuitry, and methods shown and described herein with regard to various embodiments of the invention can be implemented using software, hardware, and combinations of software and hardware. As such, the illustrated and/or described modules and circuitry are intended to encompass software implementations, hardware implementations, and software and hardware implementations.

All publications and patent applications in this specification are indicative of the level of ordinary skill in the art to which this invention pertains. All publications and patent applications are herein incorporated by reference to the same extent as if each individual publication or patent application was specifically and individually indicated by reference.

This application is intended to cover adaptations or variations of the present subject matter. It is to be understood that the above description is intended to be illustrative, and not restrictive. The scope of the present subject matter should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claims

1. A medical system comprising:

an external medical device programmer comprising control circuitry and a wireless communications module for sending instructions selected from a set of instructions wirelessly to a specific implanted medical device, the set of instructions comprising restricted and non-restricted instructions;

the external medical device programmer configured to receive input from a system user regarding which instructions from the set of instructions are to be delivered to the specific implanted medical device;

the external medical device programmer configured to determine if the user input directs delivery of restricted instructions to the specific implanted medical device and to initiate a transfer of verifying data to a remote key authority requesting permission if the user input directs delivery of restricted instructions to the specific implanted medical device, the verifying data including information regarding the specific implanted medical device; and

the external medical device programmer configured to receive a digital key from the remote key authority if permission is granted, the digital key effective to allow the external programmer to send restricted instructions to the specific implanted device, wherein the digital key is effective for a limited period of time.

2. The medical system of claim 1, wherein the external medical device programmer interrogates the implanted medical device and receives information about the specific implanted medical device and about the patient into which the specific implanted medical device has been implanted.

3. The medical system of claim 1, the verifying data including information about a patient into which the specific implanted medical device has been implanted.

4. The medical system of claim 1, the digital key including information derived from the verifying data and only effective to allow the external medical device programmer to deliver restricted instructions to the specific implanted medical device.

5. The medical system of claim 1, the digital key comprising a cryptographic key.

6. The medical system of claim 1, the restricted instructions comprising a command to reset the implanted medical device.

7. The medical system of claim 1, the restricted instructions comprising regulatory restricted and non-regulatory restricted instructions.

8. The medical system of claim 1, the external medical device programmer configured to distinguish between restricted and non-restricted instructions.

9. The medical system of claim 1, the external medical device programmer and the remote key authority configured to communicate via the internet.

10. The medical system of claim 1, the external medical device programmer and the remote key authority configured to communicate telephonically.

11. A medical system comprising:

an implantable medical device;

an external medical device programmer comprising control circuitry and a wireless communications module; and

a remote key authority comprising a processor;

the external medical device programmer configured to send instructions selected from a set of instructions wirelessly to the implanted medical device, the set of instructions comprising restricted and non-restricted instructions;

the external medical device programmer configured to receive input from a system user regarding instructions to be delivered to the implantable medical device;

the external medical device programmer configured to determine if the user input directs delivery of restricted instructions to the implanted medical device and to initiate a transfer of verifying data to a remote key authority requesting permission if the user input directs delivery of restricted instructions to the implantable medical device, the data including information regarding the implantable medical device;

the external medical device programmer configured to receive a digital key from the remote key authority if permission is granted that enables the external medical device programmer to send restricted instructions to the implantable medical device.

12. The medical system of claim 11, the remote key authority configured to select between automatically responding and requesting human input based on information regarding the restricted instruction.

13. The medical system of claim 11, restricted instructions comprising system determinable restricted instructions and system non-determinable restricted instructions, the remote key authority configured to automatically respond to system determinable restriction instruction requests and request human input for system non-determinable restricted instructions.

14. The medical system of claim 11, the verifying data including information about a patient into which the implanted medical device is implanted.

15. The medical system of claim 11, the digital key including information derived from the verifying data and only effective to allow the external programmer device to deliver restricted instructions to the specific implanted medical device.

16. The medical system of claim 11, wherein the digital key expires after a predetermined limited period of time.

17. A method for restricting programming instructions delivered to an implanted medical device comprising:

receiving with an external medical device programmer instructions from a system user for a specific implanted medical device;

sending information from the external medical device programmer regarding the specific implanted medical device to a remote key authority if the instructions are restricted instructions;

receiving a digital key from the remote key authority, the digital key configured to enable the external medical device programmer to send the restricted instructions to the specific implanted medical device.

18. The method of claim 17, further comprising assessing with the external medical device programmer whether the instructions are restricted or non-restricted.

19. The method of claim 17, further comprising interrogating the specific implanted medical device and obtaining information about the specific implanted medical device and the patient into which the implanted medical device has been implanted.

20. The method of claim 17, further comprising recording data regarding the implementation of restricted instructions, the data including a time stamp.